Check Point Revises Management Server RCE Advisory for Active Exploitation
Tech GuruQuick Answer
Check Point reports active exploitation of CVE-2026-93616, an unauthenticated file-upload and script-execution flaw in management and log-server products. Restrict management access and deploy the branch-specific hotfix while checking for compromise. This is not a Check Point Firewall Appliance or Spark Firewall vulnerability.
Confirm Scope And Apply The Supported Fix
What to do now: Limit TCP/19009 to trusted IP addresses, verify Trusted Clients settings where implied firewall rules are used, and install the applicable fixed Take or R82.20 security hotfix. Preserve relevant logs and conduct the vendor's compromise checks alongside patching.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Check Point Security Management Server, Multi-Domain Server, Log Server, Multi-Domain Log Server, and SmartEvent in affected R80 through R82.20 releases |
|---|---|
| Advisory | sk1000171 |
| CVE | CVE-2026-93616 |
| Authoritative release date | 2026-09-20 (Check Point advisory dateCreated) |
| Authority revision date | 2026-09-22 (Check Point advisory lastModified); CISA KEV addition is a separate event on 2026-09-22. |
| Affected versions | R82.20 without its hotfix; R82.10 through Jumbo Hotfix Take 44; R82 through Take 126; R81.20 through Take 166; R81.10 through Take 190; and unsupported R80/R81 releases listed by Check Point. |
| Fixed version | R82.20: vendor Security Hotfix. R82.10: Jumbo Hotfix Take 45 or later.R82: Take 127 or later.R81.20: Take 170 or later.R81.10: Take 192 or later (branch is end of support).Older end-of-support branches require a supported upgrade path. LivePatch Takes 28/29 are not a fix. |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Check Point reports attacks against customers; CISA KEV added the CVE on 2026-09-22, with due date 2026-09-25 and forensic triage Yes. Ransomware use is Unknown. A clean IOC search alone cannot establish absence of compromise. |
What Changed
The affected roles are Security Management, Multi-Domain Security Management, Log, Multi-Domain Log and SmartEvent servers. Smart-1 Cloud was fixed by the provider. Check Point says LivePatch Takes 28/29 do not address this issue and that a LivePatch fix will not be available; use the security hotfix or Jumbo Hotfix path.
What To Validate Now
- Inventory. Locate Check Point Security Management Server, Multi-Domain Server, Log Server, Multi-Domain Log Server, and SmartEvent in affected R80 through R82.20 releases deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: R82.20 without its hotfix; R82.10 through Jumbo Hotfix Take 44; R82 through Take 126; R81.20 through Take 166; R81.10 through Take 190; and unsupported R80/R81 releases listed by Check Point. Do not infer applicability from product family or severity alone.
- Remediate. Apply the fixed build for the exact branch. Do not infer that R81.20 Takes 167-169 or R81.10 Take 191 are safe merely because they fall above the listed affected ceiling; the confirmed fixed floors are 170 and 192. Arrange migration for end-of-support systems.
- Validate. Read back the exact Jumbo Take or security-hotfix installation state on every affected role, then verify SmartConsole access, policy-management operations, log collection and relevant domain services. Record incident-triage results separately from update success.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Check Point's compromise checks correlate suspicious login records with FWM/MDS core dumps and inspect resource-map load errors for traversal paths. Follow the current advisory's commands and interpretation; matching records indicate potential attempts, not a complete forensic conclusion. Preserve evidence before disruptive remediation where feasible. CISA's KEV entry also requires covered agencies to assess exposure and follow its BOD 26-04 forensic-triage requirements.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
